CVE-2020-28439 is a critical OS Command Injection vulnerability (CWE-78) affecting all versions of the corenlp-js-prefab package, stemming from a dependency on the vulnerable corenlp-js-interface package. With a CVSS score of 9.8, this vulnerability allows unauthenticated attackers to execute arbitrary commands remotely with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While no public exploits (Metasploit, Nuclei, ExploitDB) are currently available and there's minimal community discussion or media coverage, the high severity warrants immediate attention. It is not listed in CISA's Known Exploited Vulnerabilities catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:corenlp-js-prefab_project:corenlp-js-prefab:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.